chore: move to tagging builds

.gitea/workflows/build.yml

@@ -1,23 +1,42 @@
-on: push
+name: Build Docker Image
+
+on:
+  push:
+    # Only build on tags (like v1.0.0)
+    tags:
+      - "v*"
+
 jobs:
   build-docker:
     runs-on: ubuntu-latest
     container:
       image: catthehacker/ubuntu:act-latest
+
     steps:
+      # 1. Checkout the repo
+      - name: Checkout repository
+        uses: actions/checkout@v5
+        with:
+          fetch-depth: 0
+
+      # 2. Set up Docker Buildx
       - name: Set up Docker Buildx
         uses: docker/setup-buildx-action@v3
 
-      - name: Login to DockerHub
+      # 3. Log in to your registry
+      - name: Login to Docker registry
         uses: docker/login-action@v3
         with:
           registry: git.comprofix.com
           username: ${{ secrets.REGISTRY_USERNAME }}
           password: ${{ secrets.REGISTRY_TOKEN }}
 
-      - name: Build and push
+      # 4. Build and push Docker image
+      - name: Build and push Docker image
         uses: docker/build-push-action@v6
         with:
           file: ./Dockerfile
           push: true
-          tags: git.comprofix.com/mmckinnon/debian-runner:latest
+          tags: |
+            git.comprofix.com/mmckinnon/debian-runner:latest
+            git.comprofix.com/mmckinnon/debian-runner:${{ github.ref_name }}

Dockerfile

@@ -1,42 +1,61 @@
-# Base image
+# ==============================
-FROM debian:trixie-slim
+# Stage 1: Builder
+# ==============================
+FROM debian:trixie-slim@sha256:c85a2732e97694ea77237c61304b3bb410e0e961dd6ee945997a06c788c545bb AS builder
+
+# Set environment variables for noninteractive install
+ENV DEBIAN_FRONTEND=noninteractive \
+    LANG=C.UTF-8
+
+# Install build and runtime dependencies
+RUN apt-get update && apt-get install -y --no-install-recommends \
+    python3 python3-venv build-essential \
+    curl git bash openssh-client \
+    ruby-full zlib1g-dev libffi-dev libssl-dev ca-certificates \
+    && rm -rf /var/lib/apt/lists/*
+
+# Install Node.js 22 (latest patch for 22.x)
+RUN curl -fsSL https://deb.nodesource.com/setup_22.x | bash - \
+    && apt-get install -y nodejs \
+    && npm install -g npm \
+    && rm -rf /var/lib/apt/lists/*
+
+# Install Ruby gems: Jekyll and Bundler
+RUN gem install bundler jekyll
+
+# Create Python virtual environment for Ansible
+RUN python3 -m venv /opt/venv \
+    && /opt/venv/bin/pip install --no-cache-dir --upgrade pip ansible==8.*
+
+# ==============================
+# Stage 2: Runtime
+# ==============================
+FROM debian:trixie-slim@sha256:c85a2732e97694ea77237c61304b3bb410e0e961dd6ee945997a06c788c545bb
 
 # Set environment variables
 ENV DEBIAN_FRONTEND=noninteractive \
     LANG=C.UTF-8 \
-    PATH=/usr/local/bundle/bin:$PATH
+    PATH=/usr/local/bundle/bin:/opt/venv/bin:$PATH
 
-# Install dependencies
+# Install minimal runtime dependencies
 RUN apt-get update && apt-get install -y --no-install-recommends \
-    curl \
+    python3 python3-venv \
-    git \
+    curl git bash openssh-client \
-    bash \
+    ruby-full ca-certificates \
-    openssh-client \
+    nodejs \
-    python3 \
-    python3-pip \
-    build-essential \
-    zlib1g-dev \
-    libffi-dev \
-    libssl-dev \
-    ca-certificates \
     && rm -rf /var/lib/apt/lists/*
 
-# Install Node.js 22
+# Copy built tools from builder
-RUN curl -fsSL https://deb.nodesource.com/setup_22.x | bash - \
+COPY --from=builder /opt/venv /opt/venv
-    && apt-get install -y nodejs \
+COPY --from=builder /usr/local/bundle /usr/local/bundle
-    && npm install -g npm
+COPY --from=builder /usr/lib/node_modules /usr/lib/node_modules
-
+COPY --from=builder /usr/bin/node /usr/bin/node
-# Install Ansible via pip
-RUN pip3 install --no-cache-dir ansible
-
-# Install Ruby and Jekyll
-RUN apt-get update && apt-get install -y --no-install-recommends \
-    ruby-full \
-    && gem install bundler jekyll \
-    && rm -rf /var/lib/apt/lists/*
 
 # Create workspace
 WORKDIR /workspace
 
 # Default shell
 SHELL ["/bin/bash", "-c"]
+
+# Expose environment for scripts
+ENV PATH="/opt/venv/bin:/usr/local/bundle/bin:$PATH"

renovate.json

@@ -0,0 +1,19 @@
+{
+  "$schema": "https://docs.renovatebot.com/renovate-schema.json",
+  "extends": [
+    "config:recommended",
+    "renovatebot/renovate-config",
+    ":semanticCommitTypeAll(chore)"
+  ],
+  "automerge": true,
+  "automergeType": "branch",
+  "automergeStrategy": "rebase",
+  "commitBodyTable": true,
+  "ignoreTests": true,
+  "major": {
+    "automerge": false,
+    "dependencyDashboardApproval": true,
+    "commitMessagePrefix": "chore(deps-major): ",
+    "labels": ["dependencies", "breaking"]
+  }
+}